Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 04:53

General

  • Target

    a57618a045dfc6cdeb4b4e145ad96643_JaffaCakes118.exe

  • Size

    4.7MB

  • MD5

    a57618a045dfc6cdeb4b4e145ad96643

  • SHA1

    9da6760e1b4470d13ed9ded3689dc153d08869a4

  • SHA256

    57f9da48f1cfe47d500c9a45623d639f9a4dfb2f5cc9b62730ab9eb7dde5eca0

  • SHA512

    2d801f35f6b8828004575622201562d6844731c43a70ca405239eeb0bca3cc7711666f25a81275ade26db9fdf254da40148af326c695000e9e9c9126602583e8

  • SSDEEP

    98304:f7DRxg/2I0ZWXpEkYl2Q3NOy3AacPTd+46EeJkCsgFBCCbmSlTpFS:j1xg/2NEXpEkYl2Q3j3Aas+4OmT0cumF

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a57618a045dfc6cdeb4b4e145ad96643_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a57618a045dfc6cdeb4b4e145ad96643_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:3808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nst8FAE.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

  • C:\Users\Admin\AppData\Local\Temp\nst8FAE.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    9384f4007c492d4fa040924f31c00166

    SHA1

    aba37faef30d7c445584c688a0b5638f5db31c7b

    SHA256

    60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

    SHA512

    68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

  • C:\Users\Admin\AppData\Local\Temp\nst8FAE.tmp\UAC.dll

    Filesize

    17KB

    MD5

    09caf01bc8d88eeb733abc161acff659

    SHA1

    b8c2126d641f88628c632dd2259686da3776a6da

    SHA256

    3555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478

    SHA512

    ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa

  • C:\Users\Admin\AppData\Local\Temp\nst8FAE.tmp\ioSpecial.ini

    Filesize

    1KB

    MD5

    6660782c11a2ead9deaee23a92d9420b

    SHA1

    7dbd3a8e8d403f5fe9ff63f7a7b657ddfa3c1286

    SHA256

    773e5076553c20b8aa0027e5d4f35d59c01f5ab7566ee1bb8adf969a35849713

    SHA512

    51417db82fdcb9628bce97c337c904d5aa49bd85b3175af54ea34c3a574544982f3cb97042d9d2a57397b8213c6b7f395271185c51f3debcbc4d7caf8618744a